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DETAILED ACTION 

1 . This office action is in response to Applicant's amendment filed on 
3/9/2005. Claim 1 has been amended. Claims 1-39 are pending. 

Response to Arguments 

2. Applicant's arguments with respect to independent claims have been 
considered but are moot in view of the new ground(s) of rejection. 

In respect to Applicant's argument on claim 14, Applicant references the 
claim as a rejection under 35 USC 103. However, claim 14 is rejected 
under 35 USC 102. 

Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this 
Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for patent or 
(2) a patent granted on an application for patent by another filed in the United States before 
the invention by the applicant for patent, except that an international application filed under 
the treaty defined in section 351(a) shall have the effects for purposes of this subsection of an 
application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

Claim 14 is rejected under 35 U.S.C. 102(e) as being anticipated by Doi et 
al. (U.S. Patent No. 6,697,370). 

In respect to claim 14, Doi discloses a method for determining the best 
connection or path for a router to transmit traffic to a specific destination on a 
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network, wherein a path on a network includes a plurality of independent 
segments that are coupled together via links, and wherein the volume of users on 
the network defines the network load, comprising: analyzing the amount of 
network load; and analyzing link availability to determine the specific links to 
traverse, wherein the analysis of link availability comprises: analyzing traffic load 
on the specific link pathway, wherein the traffic load is the volume of users on the 
specific link; and analyzing the availability of the network (see col. 1, line 19-col. 
5, line 52). 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 1 02 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

Claim 15 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Doi et al. (U.S. Patent No. 6,697,370) in view of Beigi et al. (U.S. Patent No. 
6,363,056, hereinafter Beigi). 

In respect to claim 15, Doi discloses a method as claimed in claim 14. Doi 
does not explicitly disclose but: Beigi discloses transmitting a sample packet from 
a starting point and measuring the amount of time for the Packet to return to the 
starting point (see Beigi, Abstract). It would have been obvious to one of ordinary 
skill in the art at the time the invention was made to incorporate the teaching of 
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analyzing traffic load on a specific pathway taught by Doi with the teaching of 
determining the round trip time by using probe packets in order to estimate the 
expected amount of time of network traffic to be received (Beigi, Abstract). 



5. Claims 1-13 and 16-39 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Shanklin et al. (U.S. Patent No. 6/578,147, hereinafter 
Shanklin) in view of Putzolu et al. (U.S. Patent No. 6,587,432). 

In respect to claim 1 , Shanklin discloses a detection system for identifying 
and eliminating excessive requests for information on a network to prevent the 
failure of a portion of the network, comprising (see col. 4, lines 25-41, denial of 
service): 

at least one server, wherein the switching device and server are in 
electronic communication with each together; and wherein the switching device is 
configured to receive requests for information and attempts to respond to the 
request (see Fig. 1, col. 3, lines 10-18); 

and an activity monitoring system, the activity monitoring system 
comprising a route arbiter and a traffic analyzer, wherein the activity monitoring 
system is in electronic communication with the switching device (see Fig. 2, col. 
5, lines 14-55). 

Shanklin discloses at least one switching device, wherein the switching 
device has predefined parameters for distributing and balancing incoming data 
packets (Fig. 2, col. 1 , line 63-coL 2, line 13 and col. 5, lines 20-28, one-third of 
the sessions in a given datastream). Shanklin does not explicitly disclose a 
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predefined parameters for receipt of an acceptable volume of requests for 
information. However, Putzolu discloses a network monitoring agent and a 
tracing agent monitors and analyze traffic on a network to detect network 
congestion condition (see col. 1, lines 41-55 and col. 3, line 43-col. 4, line 4, 
"congestion traffic may be traffic which existed prior to a excess traffic condition, 
such as in the case where other additional traffic, when added to a network, 
causes an excess traffic condition... or may be the traffic which existed on the 
healthy link prior to the failure..." (Putzolu, col. 1 , lines 42-49). It is inherently 
required that a predetermined parameter is needed in order to determine whether 
the traffic volumes have reached a congestion condition). Therefore, it would 
have been obvious to one of ordinary skill in the art at the time the invention was 
made to incorporate the traffic monitoring and analyzing of network traffic volume 
to detect network congestion condition taught by Putzolu with the intrusion 
detection for identifying and detecting network attack with stored signature such 
as denial of service so that information about congestion traffic can be quickly 
and accurately collected (Putzolu, col. 2, lines 51-56). 

In respect to claim 2, Shanklin and Putzolu disclose a detection system as 
claimed in claim 1 , further comprising a firewall, wherein the firewall is configured 
to receive requests for information (see Shanklin col. 1, lines 19-16). 

In respect to claim 3, Shanklin and Putzolu disclose a detection system as 
claimed in claim 1 , wherein the route arbiter monitors the requests received by 
the router (see Shanklin, Fig. 1, col. 3, lines 10-18). 
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In respect to claim 4, Shanklin and Putzolu disclose a detection system as 
claimed in claim 2, wherein the route arbiter is coupled to the firewall and the 
switching device, and wherein the route arbiter monitors the requests received by 
the firewall and the switching device (see Fig. 2, col. 1, lines 19-16, col. 3, lines 
10-18 and col. 5, lines 14-55). 

In respect to claim 5, Shanklin and Putzolu disclose a detection system as 
claimed in claim 1 , wherein the route arbiter is configured to compare the volume 
of requests to the predefined parameters for the receipt of an acceptable volume 
of requests (see Putzolu, col. 1, lines 41-55 and col. 3, line 44-col. 4 t line 4). 

In respect to claim 6, Shanklin and Putzolu disclose a detection system as 
claimed in claim 1, wherein the route arbiter is configured to instruct the switching 
device to direct requests for information to the traffic analyzer (see Shanklin, Fig. 
3-4, col. 5, line 55-col. 6, line 4 and col. 7, lines 20-28). 

In respect to claim 7, Shanklin and Putzolu disclose a detection system as 
claimed in claim 1, further comprising a null address router, wherein the null 
address router is coupled to the traffc analyzer (see Shanklin, col. 4, lines 54-61). 

In respect to claims 8, 11, 16, 17, 19,21,25-26 and 31, the claim 
limitations are similar to claims 1 and 4. Therefore, claims 8, 1 1, 16-17. 25-26 
and 31 are rejected based on the similar rationale. 

In respect to claim 9, Shanklin and Putzolu disclose a method as claimed 
in claim 8, wherein responding to the forwarding of packets of information further 
comprises instructing the first network to cease advertising the network address 
to the second network device (see Shanklin, col. 1 , lines 19-26). 
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In respect to claim 10, Shanklin and Putzolu disclose a method as claimed 
in claim 8, wherein responding to the forwarding of packets of information further 
comprises forwarding the packets of information from the analyzer to a null 
address router (see Shanklin, col. 4, lines 54-61). 

In respect to claim 12, the claim limitation is similar to claim 9. Therefore, 
claim 12 is rejected based on the similar rationale. 

In respect to claim 18, Shanklin and Putzolu disclose the detection system 
of claim 16, further comprising a firewall coupled to the switching device (see 
Shanklin, col. 1, lines 19-26). 

In respect to claim 20, the claim limitation is similar to claim 10. Therefore, 
claim 20 is rejected based on the similar rationale. 

In respect to claim 22, Shanklin and Putzolu disclose the method of claim 

21, wherein the predefined condition is associated with abnormal network activity 
(see Shanklin, col. 4, lines 31-41). 

In respect to claim 23, Shanklin and Putzolu disclose the method of claim 

22, wherein the abnormal network activity is the occurrence of a nondecreasing 
volume of traffic at a predefined threshold level for a predefined period of time 
(see Putzolu, col. 1, lines 40-55 and col. 3, line 44-col. 4, line 4). 

In respect to claim 24, Shanklin and Putzolu disclose the method of claim 
21, wherein the predefined condition is associated with abnormal traffic patterns 
(see Shanklin, col. 4, lines 31-41). 
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In respect to claim 27, Shanklin and Putzolu disclose the activity 
monitoring system of claim 26, wherein the route arbiter is coupled to the network 
via a switching device (see Shanklin, col. 5, lines 14-20). 

In respect to claim 28, Shanklin and Putzolu disclose the activity 
monitoring system of claim 27, wherein the switching device is a router (see 
Abstract). 

In respect to claim 29, Shanklin and Putzolu disclose the activity 
monitoring system of claim 26, wherein the predefined acceptance criteria 
indicate whether the influx of network activity is changing in volume (see Putzolu, 
col. 1, lines 44-55 and col. 3, line 44-col. 4, line 4). 

In respect to claim 30, Shanklin and Putzolu disclose the activity 
monitoring system of claim 26, wherein the predefined acceptance criteria 
indicate that the network activity is not decreasing in volume, and wherein the 
predefined response criteria is a threshold network activity level (see Putzolu, 
col. 1, lines 44-55 and col. 3, line 44-col. 4, line 4). 

In respect to claim 32, Shanklin and Putzolu disclose the method of claim 
31 , wherein the predefined redirection criteria cause the problematic traffic to be 
blocked (see Putzolu, col. 1, lines 44-55 and col. 3, line 44-col. 4, line 4). 

In respect to claim 33, Shanklin and Putzolu disclose the method of claim 
31 , wherein the predefined redirection criteria cause the problematic traffic to be 
redirected to a device that does not respond to the problematic traffic (see 
Shanklin, col. 17, line65-col. 18, line 12). 
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In respect to claims 34-35, the claim limitations are similar to claim 33. 
Therefore, claims 34-35 are rejected based on the similar rationale. 

In respect to claim 36, Shanklin and Putzolu disclose the activity 
monitoring system of claim 26, wherein the route arbiter is coupled to a peering 
point located upstream from a plurality of edge devices (see Shanklin, col. 5, 
lines 20-55). 

In respect to claim 37, Shanklin and Putzolu disclose the detection system 
of claim 1 , wherein the activity monitoring system is incorporated into the 
switching device (see Shanklin, col. 5, line 55-col. 6, line 65). 

In respect to claim 38, Shanklin and Putzolu disclose the detection system 
of claim 1 , wherein the route arbiter is incorporated into the switching device and 
the traffic analyzer is maintained in a separate device (see Shanklin, col. 5, line 
55-col. 6, line 65). 

In respect to claim 39, Shanklin and Putzolu disclose the detection system 
of claim 1 , wherein the traffic analyzer is incorporated into the switching device 
and the route arbiter is maintained in a separate device (see col. 5, line 55-col. 6, 
line 65). 

Conclusion 

6. Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Tongoc Tran whose telephone number is 
(571 ) 272-3843. The examiner can normally be reached on 8:30-5:00. 
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If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Gregory Morse can be reached on (571) 272-3838. The 
fax phone number for the organization where this application or proceeding is 
assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). 
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